Amazon ECS Concepts
External
Internal
Overview
Amazon Elastic Container Service (ECS) allows deploying Docker containers on a scalable cluster. Docker images to be deployed typically come from Amazon ECR.
Container
A container, in this context, is a Docker container, concept explained at length here:
Cluster
An Amazon ECS cluster is a regional, logical grouping of tasks and services. If the tasks or services in question use the EC2 launch type, the cluster is also a grouping of container instances. A default cluster is always available, but multiple clusters can be created in an account to keep your resources separate. A cluster cannot span more than one region.
Relationship between a Cluster and a VPC
TODO
Cluster Configuration
Cluster Name
Cluster VPC
See above:
Cluster Subnets
Cluster Operations
Task
A task is a running instance of a container. A running task listens on ports, generates logs, and hopefully does useful work. The running tasks is generated based on a task definition and is usually started by a service. However, a task can be manually run (Task Definitions -> Actions -> Run Task) after specifying the cluster, the number of tasks, the VPC and the subnet.
Running Task
A running task is based on a task definition and it has an unique ID (e.g. e822d0018c324c47a2001e8ea6a76d4f). The running task has associated time statistics, such as "Created at" and "Started at". Also, stdout content generated while the task is running is available as Cluster -> <cluster-name> -> Tasks -> <task-id> -> Logs. Every time the task is started, it gets a new Private IP, and if it was configured with one, a new Public IP.
A running task may be started by a service. When a task has been started by a service, the task could be restarted (re-deployed) by navigating in console to the service, selecting the task, selecting the task in question and then "Stop"-ing it. A warning will pop up, saying that the task has been started by a service, but it can be safely stopped: the service will start a replacement. However, this is normally not necessary, the service detects failed tasks and starts new ones automatically.
Consolidate with Deployments.
Stopped Task
Task Definition
A task definition is a blueprint, or a configuration, for an application, and describes one or more containers through attributes. The task definition is used by a service to start tasks. Some attributes are configured at the task level but the majority of attributes are configured per container. It specifies the Docker image, how many containers to use for this task and the resource allocation for each container. To modify the task definition, a new revision must be created and then make the required changes to the task definition.
Task definitions exist outside clusters, and can be shared between clusters.
Task Definition Name
Network Mode
The Docker networking mode to use for the container in the task. A typical conventional value is "awsvpc".
Task Role
The task role is the IAM role that allows the containers in the task permission to call the AWS APIs that are specified in its associated policies on the IAM user's behalf. The steps necessary to create a Task Role, as well as specific individual permissions are described in detail in:
Task Execution Role
The task execution role is the IAM role that allows the containers in the task to pull container images, publish container logs to CloudWatch, upgrade the load balancer with the endpoint details of the containers, all on the IAM user's behalf. The steps necessary to create a Task Role, as well as specific individual permissions are described in detail in:
Compatibilities
The launch type used by the task.
Task Memory
Task CPU
Task Revision
A new task revision is created when a task definition is modified.
Task Definition Operations
Service
A service allows running and maintain a specified number (the "desired count") of simultaneous instances of a task, created based on a task definition, in an ECS cluster. The service launches and maintains running tasks in the cluster. It detects stopped tasks and starts new ones to maintain the number of tasks specified in the service definition. If the number of tasks exceeds 1, a load balancer is required to distribute incoming traffic amongst sibling tasks.
The concept of a service is intrinsically linked to the concepts of deployment.
Unlike a task definition, a service only exists within a cluster, and cannot be shared between clusters. From this perspective, a service can be thought of as an instantiation context of a task, specifying the cluster, the VPC, subnet, security group, etc.
Service Type
It ca be REPLICA for a FARGATE launch, or REPLICA or DAEMON an EC2 launch.
Service Security Group
A security group is created to allow all public traffic to the service only on the container port specified. Security groups and network access can be further refined after the service creation.
The name of the security group can be changed at this stage, as well as the port configuration.
Service Load Balancing
Load balancing settings can only be configured on service creation. If the service is to be exposed as integration endpoint by the API Gateway, it needs a network load balancer.
Service Discovery and DNS
Updating existing services to configure service discovery for the first time or change the current configuration is not supported. Service discovery should be configured when the service is created.
If the service discovery was enabled for a service, the service's private IP address becomes resolvable as a internal DNS name in the namespace that was configured for the service. The DNS name is correctly resolved a newly-allocated IP address, should the backing task be restarted and get a new IP address.
Service Operations
Deployments
Consolidate with Running Tasks.
Rolling Update
A rolling update replaces the current version of the task in the service with a new version. To control the number of your service's tasks in the RUNNING state during a deployment, set the "minimum healthy percent" and "maxium healthy percent" values. This deployment configuration allows for AWS CLI command line redeployments.
Blue/Green Deployment
A blue/green deployment allows to verify a new version of the application before routing production traffic to it. Production traffic can be routed between new and old versions, closely monitor the deployment process, and quickly rollback a deployment if there is an issue.
Choosing a blue/green deployment for an ECS service will configure the service with a deployment controller of type "CODE_DEPLOY" - which means AWS CodeDeploy - and will also automatically create corresponding AWS CodeDeploy application and deployment group with default settings that can be updated later. This configuration is required if an (additional) AWS CodeDeploy deployment group is created for this service.
Launch Type
EC2 Launch Type
The EC2 launch type allows running a containerized applications on a cluster of Amazon EC2 instances.
Fargate Launch Type
The Fargate launch type allows running a containerized application without the need to provision and manage the backend infrastructure. It only requires registering a task definition. When that is available, Fargate launches the container.
ECS Networking
CloudFormation
Auto Scaling
TODO